CVE-2022-2456: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request (GitLab Security Release, NVD).

The vulnerability exists due to improper validation in the visibility level change functionality. The check for user permission is performed after verifying if the new visibility differs from the current visibility level of the project. The level_value method returns 0 (PRIVATE) for any input except 10, 20, 'internal', 'public', which allows bypassing the permission check. The vulnerability has a CVSS v3.1 Base Score of 4.9 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) (GitLab Security Release).

A malicious maintainer could exploit this vulnerability to change the visibility settings of projects or groups they have access to, potentially exposing private information to unauthorized users. This affects both self-managed GitLab instances and gitlab.com projects (GitLab Security Release).

The vulnerability has been fixed in GitLab versions 15.2.1, 15.1.4, and 15.0.5. Users are strongly recommended to upgrade to one of these patched versions immediately. GitLab.com has already been updated with the patched version (GitLab Security Release).